Seccomp filters for multi-threaded programs

Posted May 30, 2014 17:17 UTC (Fri) by luto (subscriber, #39314)
In reply to: Seccomp filters for multi-threaded programs by felixfix
Parent article: Seccomp filters for multi-threaded programs

It's both a correctness and efficiency thing.

The correctness issue is that users of sync want every other thread to end up at least as confined as the current thread.

The efficiency issue is that, internally, there's a tree of filters. Adding a filter makes a new child node. If you can share nodes between threads, you save on memory and cache impact.